@stigmer/runner 3.40.0 → 3.41.0

package/src/activities/execute-deep-agent/__tests__/inline-publisher.test.ts

@@ -6,6 +6,7 @@ import { tmpdir } from "node:os";
 import { create } from "@bufbuild/protobuf";
 import { type AgentExecutionStatus, AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { ExecutionArtifactKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ExecutionArtifactSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/artifact_pb";
 import { InlinePublisher } from "../inline-publisher.js";
 import { TranscriptBuilder } from "../../../harness/transcript/builder.js";
 import { LocalWorkspaceBackend } from "../../../shared/workspace/local-backend.js";
@@ -71,6 +72,7 @@ describe("InlinePublisher", () => {
       workspaceBackend: backend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-123",
     });
   });
@@ -97,6 +99,25 @@ describe("InlinePublisher", () => {
     expect(status.artifacts[0].sandboxPath).toBe("src/main.ts");
   });
 
+  it("stamps createdAt when the publish is asked for, never when the upload returns", async () => {
+    // The stream asks for the publish as it folds the write's finish, and the
+    // upload runs on beside the stream; a slow store must not move the stamp.
+    vi.useFakeTimers({ toFake: ["Date"], now: Date.UTC(2026, 0, 1) });
+    try {
+      const askedAt = new Date().toISOString();
+      vi.mocked(storage.upload).mockImplementationOnce(async (key: string) => {
+        vi.setSystemTime(Date.now() + 5_000);
+        return key;
+      });
+
+      await publisher.publish("src/main.ts");
+
+      expect(status.artifacts[0].createdAt).toBe(askedAt);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it("deduplicates by path + content hash", async () => {
     await publisher.publish("src/main.ts");
     await publisher.publish("src/main.ts");
@@ -124,6 +145,64 @@ describe("InlinePublisher", () => {
     expect(publisher.publishedPaths.has("src/main.ts")).toBe(true);
   });
 
+  // A reinvocation seeds the earlier turns' rows onto the status before the
+  // turn's publisher exists; the safety net then asks for those paths again.
+  describe("against rows the status already lists (stigmer/stigmer#1448)", () => {
+    function seedRow(sandboxPath: string, content: string): void {
+      status.artifacts.push(create(ExecutionArtifactSchema, {
+        name: sandboxPath.split("/").at(-1) ?? sandboxPath,
+        sandboxPath,
+        kind: ExecutionArtifactKind.FILE,
+        storageKey: `artifacts/exec-123/${sandboxPath.split("/").at(-1)}`,
+        contentHash: sha256(content),
+      }));
+    }
+
+    it("uploads nothing for a file whose bytes the status already lists, and counts it as brought up to date", async () => {
+      seedRow("src/main.ts", "console.log('hello');");
+      const seeded = status.artifacts[0];
+
+      await publisher.publish("src/main.ts");
+
+      expect(storage.uploadedKeys, "the unchanged file is not sent again").toEqual([]);
+      expect(status.artifacts, "the seeded row is kept as it was").toEqual([seeded]);
+      expect(publisher.publishedPaths.has("src/main.ts")).toBe(true);
+    });
+
+    it("uploads and replaces the row when the file changed since the status listed it", async () => {
+      seedRow("src/main.ts", "an earlier turn's bytes");
+
+      await publisher.publish("src/main.ts");
+
+      expect(storage.uploadedKeys).toEqual(["artifacts/exec-123/main.ts"]);
+      expect(status.artifacts).toHaveLength(1);
+      expect(status.artifacts[0].contentHash).toBe(sha256("console.log('hello');"));
+    });
+
+    it("still reads the file, so a rewrite made outside a write tool is caught", async () => {
+      seedRow("src/main.ts", "console.log('hello');");
+
+      await publisher.publish("src/main.ts");
+
+      expect(backend.readFile).toHaveBeenCalledWith("src/main.ts");
+    });
+
+    it("leaves an earlier turn's path out of publishedPaths until this turn checks it", () => {
+      seedRow("src/main.ts", "console.log('hello');");
+
+      expect(publisher.publishedPaths.size).toBe(0);
+    });
+
+    it("uploads a file the status lists under another path", async () => {
+      seedRow("docs/main.ts", "console.log('hello');");
+
+      await publisher.publish("src/main.ts");
+
+      expect(storage.uploadedKeys).toEqual(["artifacts/exec-123/main.ts"]);
+      expect(status.artifacts.map((a) => a.sandboxPath)).toEqual(["docs/main.ts", "src/main.ts"]);
+    });
+  });
+
   it("swallows errors without throwing (fire-and-forget)", async () => {
     const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
     const failBackend = mockWorkspaceBackend({});
@@ -132,6 +211,7 @@ describe("InlinePublisher", () => {
       workspaceBackend: failBackend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-err",
     });
 
@@ -176,6 +256,7 @@ describe("InlinePublisher", () => {
       workspaceBackend: secretBackend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-secret",
     });
 
@@ -193,6 +274,7 @@ describe("InlinePublisher", () => {
       workspaceBackend: jsonBackend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-ct",
     });
 
@@ -221,6 +303,7 @@ describe("InlinePublisher with LocalWorkspaceBackend (disk-backed)", () => {
       workspaceBackend: backend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-disk",
     });
 
@@ -250,6 +333,7 @@ describe("InlinePublisher with LocalWorkspaceBackend (disk-backed)", () => {
       workspaceBackend: backend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-miss",
     });
 

package/src/activities/execute-deep-agent/__tests__/platform-route.test.ts

@@ -3,16 +3,20 @@
 // builds (`createCasCaptureBackend` + `mountPlatformRoute`, parent and
 // sub-agents alike). The stock virtual-rooted backend refuses to follow the
 // workspace link out of the root; the route mounts the platform dir instead,
-// read-only, on the turns the link exists. What is pinned:
+// read-only, on the turns the link exists, and an empty route on every other
+// turn. What is pinned:
 //  - the stock backend's refusal (why the route exists);
 //  - reads, listings and search through the route, for the shell-capable and
 //    the plan-mode backend, with `execute` kept exactly where it was;
 //  - every mutation through the route refused, and a root delete refused
 //    before it touches the workspace or the platform dir;
-//  - no route on a turn without the link.
+//  - on a turn without the link, `.stigmer/` still the platform's: nothing
+//    readable, every write refused and nothing created in the workspace (the
+//    write that used to make a real directory there, #1123), and the root
+//    listing without it.
 
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { FilesystemBackend, isSandboxBackend } from "deepagents";
@@ -120,23 +124,56 @@ describe("platform route", () => {
     });
   });
 
-  it("mounts nothing on a turn without the link", async () => {
-    const workspace = await createCasCaptureBackend({ rootDir: workspaceDir, observer: observer(), shellEnv: {} });
-    expect(await mountPlatformRoute(workspace, { workspaceDir, platformDir })).toBe(workspace);
-    expect(await mountPlatformRoute(workspace, { workspaceDir, platformDir: undefined })).toBe(workspace);
+  describe.each(["shell", "plan"] as const)("the %s backend on a turn without the link", (mode) => {
+    it("refuses every write under .stigmer/ and creates nothing in the workspace", async () => {
+      const backend = v2(await productionBackend(mode));
+      expect(backend).toBeInstanceOf(PlatformRoutedBackend);
+      expect((await backend.write(`${PLATFORM_ROUTE_PREFIX}notes/draft.md`, "x")).error).toMatch(/read-only/);
+      expect((await backend.edit(`/${SKILL}`, "My Skill", "Your Skill")).error).toMatch(/read-only/);
+      const uploads = (await backend.uploadFiles!([[`${PLATFORM_ROUTE_PREFIX}up.bin`, new Uint8Array([1])]])) ?? [];
+      expect(uploads.map((u) => u.error)).toEqual(["permission_denied"]);
+      await expect(lstat(join(workspaceDir, ".stigmer")), "no real directory in the user's tree").rejects.toMatchObject({
+        code: "ENOENT",
+      });
+    });
+
+    it("exposes nothing of the platform dir, which still holds earlier turns' content", async () => {
+      const backend = v2(await productionBackend(mode));
+      expect((await backend.read(`/${SKILL}`)).error).toMatch(/no platform content/);
+      expect((await backend.ls(PLATFORM_ROUTE_PREFIX)).error).toMatch(/no platform content/);
+      const found = (await backend.glob("**/SKILL.md", "/")).files ?? [];
+      expect(found).toEqual([]);
+    });
+
+    it("lists the workspace at the root without .stigmer/", async () => {
+      const backend = v2(await productionBackend(mode));
+      const root = ((await backend.ls("/")).files ?? []).map((f) => f.path);
+      expect(root).toContain("/main.go");
+      expect(root).not.toContain(PLATFORM_ROUTE_PREFIX);
+    });
+
+    it("keeps `execute` exactly where the workspace backend had it", async () => {
+      const backend = await productionBackend(mode);
+      expect(isSandboxBackend(backend)).toBe(mode === "shell");
+    });
   });
 
-  it("mounts nothing when the link points somewhere else", async () => {
+  it("exposes nothing when the link points somewhere else", async () => {
     const other = await mkdtemp(join(tmpdir(), "platform-route-other-"));
     try {
       await ensureStigmerSymlink(workspaceDir, other);
-      const workspace = await createCasCaptureBackend({ rootDir: workspaceDir, observer: observer() });
-      expect(await mountPlatformRoute(workspace, { workspaceDir, platformDir })).toBe(workspace);
+      const backend = v2(await productionBackend("plan"));
+      expect((await backend.read(`/${SKILL}`)).error).toMatch(/no platform content/);
     } finally {
       await rm(other, { recursive: true, force: true });
     }
   });
 
+  it("mounts nothing for a session without a platform dir", async () => {
+    const workspace = await createCasCaptureBackend({ rootDir: workspaceDir, observer: observer(), shellEnv: {} });
+    expect(await mountPlatformRoute(workspace, { workspaceDir, platformDir: undefined })).toBe(workspace);
+  });
+
   it("a workspace entry of its own is untouched by the route", async () => {
     await mkdir(join(workspaceDir, "src"));
     await writeFile(join(workspaceDir, "src/a.ts"), "export {};\n");